Data Protection
Your privacy matters to us. This Privacy Policy explains precisely what personal data bltoto collects from its members, how that data is used, who it may be shared with, and the rights you hold over your own information. We encourage you to read it in full before registering.
Last Updated: 1 January 2026Our Commitments
All data transmitted between your browser and bltoto's servers is encrypted using industry-standard TLS/SSL protocols, keeping your credentials and financial information secure in transit.
bltoto does not sell, rent, or trade your personal data to third-party marketing companies. Your information is used solely to operate, improve, and secure the platform.
Internal access to member data is strictly role-based. Only authorized personnel with a legitimate operational need can access your personal information.
We collect only the data that is necessary to operate your account, process transactions, verify your identity, and comply with legal obligations — nothing more.
You have the right to access, correct, delete, and export the personal data bltoto holds about you. Submit a request to our support team and we will respond within 30 days.
In the unlikely event of a data breach that poses a risk to your rights, bltoto will notify affected members promptly and take immediate remedial action in line with applicable standards.
Member Rights
As a bltoto member, you are entitled to exercise the following rights at any time by contacting our support team.
Request a copy of all personal data bltoto holds about you, including account details, transaction history, and communication logs.
Request correction of any inaccurate or incomplete personal data we hold about you. We will update records within 5 business days.
Request deletion of your personal data where there is no compelling legal basis for us to continue retaining it.
Receive your personal data in a structured, machine-readable format that you can transfer to another service provider.
Object to the processing of your personal data for direct marketing purposes at any time — we will honor your request immediately.
Request that we restrict the processing of your data while a dispute about its accuracy or the legal basis for processing is resolved.
bltoto ("we", "us", "our") operates the online betting and gaming platform accessible at https://bltoto.cam. We are committed to protecting the privacy and security of all personal data provided to us by our members, visitors, and prospective members, particularly those based in Indonesia.
This Privacy Policy describes in clear terms which categories of personal data we collect, the purposes for which that data is processed, the lawful bases on which processing rests, and the controls available to you as a data subject. This Policy applies to all personal data collected through the bltoto website, mobile-optimized pages, customer support channels, and any other touchpoint where personal information is exchanged.
If you have any questions about this Policy or wish to exercise any of your data rights, please contact us at the details provided in Section 16 below.
For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:
bltoto collects the following categories of personal data:
bltoto collects personal data through the following channels:
bltoto processes your personal data for the following specific purposes:
| Purpose | Data Categories Used |
|---|---|
| Account creation and management | Registration data, device data |
| Age and identity verification (KYC) | KYC data, registration data |
| Processing deposits and withdrawals | Financial transaction data, KYC data |
| Operating betting and gaming services | Betting activity data, financial data |
| Fraud prevention and AML compliance | All categories as required |
| Customer support and dispute resolution | Communications data, account data |
| Responsible gaming monitoring | Betting activity data, account data |
| Platform security and abuse prevention | Technical data, device data |
| Marketing communications (with consent) | Registration data, activity data |
| Analytics and platform improvement | Technical data, activity data |
| Legal and regulatory compliance | All categories as required |
We do not use your personal data for automated decision-making that produces significant legal effects on you without human review, except where this is strictly necessary for fraud detection or as required by applicable law.
Each processing activity carried out by bltoto rests on at least one of the following lawful bases:
bltoto does not sell or rent personal data to any third party. We may share your data with the following categories of recipients only where strictly necessary:
We engage trusted third-party processors to help us deliver services, including: payment gateway operators (bank transfer APIs for BCA, BRI, BNI, Mandiri; e-wallet processors for OVO, DANA, GoPay, ShopeePay, LinkAja), identity verification platforms, cloud hosting providers, analytics services, and customer support software vendors. All such providers are bound by contractual data protection obligations and may not use your data for their own purposes.
Where your gaming sessions are powered by third-party game studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, or Pocket Games Soft, certain session data (player ID, bet amount, game outcome) is shared with those studios to operate the games and calculate RTP. This data sharing is governed by our agreements with each studio and is limited to what is operationally necessary.
We may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other government authorities when required to do so by applicable law, a valid legal process, or where we believe disclosure is necessary to prevent fraud, money laundering, or a threat to the safety of any person.
In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify affected members via their registered email address before any such transfer takes effect and ensure that the receiving party upholds equivalent data protection standards.
As an internationally licensed platform serving members primarily in Indonesia, some of your personal data may be processed or stored on servers located outside of Indonesia. When such transfers occur, bltoto ensures that appropriate safeguards are in place, including:
By using the bltoto platform, you acknowledge that your data may be processed in jurisdictions outside Indonesia. Where data is transferred, we ensure the level of protection afforded to that data is at least equivalent to that described in this Privacy Policy.
bltoto uses cookies and similar tracking technologies to operate the platform effectively and to improve your experience. The types of cookies we use are:
These cookies are essential for the platform to function. They manage your login session, maintain your betting slip across pages, and protect against cross-site request forgery attacks. You cannot opt out of strictly necessary cookies without disabling the platform entirely.
We use analytics cookies to understand how members navigate the platform — which pages are most visited, how long sessions last, and where users encounter errors. This information is aggregated and anonymized wherever possible. We use this data solely to improve platform performance and usability.
Functional cookies remember your preferences — such as your preferred odds format, language settings, and which sports categories you follow most frequently — so that you don't need to reconfigure them on each visit.
With your consent, we may use marketing cookies to deliver promotional content that is relevant to your interests and betting activity. You may withdraw consent for marketing cookies at any time through your account settings or by contacting our support team.
You can manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of specific platform features. Detailed cookie lists and opt-out controls are available in the Cookie Settings panel accessible from any page on the platform.
bltoto retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following standard retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Legal obligation / AML compliance |
| KYC documents | Duration of account + 5 years post-closure | Legal obligation / AML compliance |
| Financial transaction records | 7 years from transaction date | Legal obligation / Tax records |
| Betting & gaming activity logs | 5 years from activity date | Legitimate interests / Dispute resolution |
| Customer support communications | 3 years from last interaction | Legitimate interests / Legal claims |
| Analytics and device data | 26 months from collection | Legitimate interests |
| Marketing consent records | Until withdrawal of consent + 1 year | Legal obligation (consent proof) |
After the relevant retention period expires, personal data is securely deleted or anonymized so that it can no longer be attributed to any individual.
bltoto implements a layered set of technical and organizational security measures designed to protect your personal data against unauthorized access, loss, destruction, or alteration. These include:
bltoto's services are strictly reserved for adults aged 21 years and over. We do not knowingly collect personal data from anyone under the age of 21. Our registration process requires applicants to declare their date of birth and consent to identity verification, and KYC procedures are specifically designed to detect and reject underage registrations.
If we become aware that we have inadvertently collected personal data from a person under 21 years of age, we will immediately close the associated account, delete all related personal data to the extent permitted by our legal obligations, and refund any deposited funds in full. If you believe a minor has registered on our platform, please notify us immediately at the contact details in Section 16.
You may exercise any of the data rights described earlier in this Policy (access, rectification, erasure, portability, objection, restriction) by submitting a written request to our data protection contact. To protect your privacy, we will verify your identity before processing any rights request.
bltoto will acknowledge your request within 3 business days and provide a substantive response within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days; in such cases, we will notify you of the extension and the reason for it.
We may decline a request where fulfilling it would conflict with a legal obligation (for example, retaining AML records as required by law), where the request is manifestly unfounded or excessive, or where it would adversely affect the rights and freedoms of other individuals. In any such case, we will explain the reason for the refusal in writing.
The bltoto platform may contain references to third-party game studios, payment processors, and sports data providers. Where such references include links to external websites or services, please note that bltoto is not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any external service you engage with separately. Our Privacy Policy applies solely to data processed by bltoto through the bltoto platform.
bltoto reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform functionality. When material changes are made, we will notify members via their registered email address and post a prominent notice on the platform at least 7 days before the revised Policy takes effect.
Minor clarifications — such as correcting typographical errors or improving readability without changing the substance of our practices — may be made without advance notice. The "Last Updated" date at the top of this Policy will always reflect the most recent revision. Your continued use of the platform after the effective date of a revised Policy constitutes your acceptance of the changes.
If you have any questions about this Privacy Policy, wish to exercise a data right, or would like to raise a complaint about our data practices, please contact us through any of the following channels:
Our support team includes native Indonesian-speaking agents available around the clock, including during Idul Fitri, Ramadhan, and all Indonesian public holidays, to assist with any privacy-related questions in a language you are comfortable with.
If you are not satisfied with our response to a complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction.
Our FAQ has clear answers on account security and data handling. You can also review our full Terms & Conditions or visit our Responsible Gaming page for player protection information.